From 17806aa1fe904e3fcf677070c2b7a991f6af66f5 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Tue, 20 Oct 2026 01:32:57 -0400 Subject: [PATCH] fix(managed-files-guard): explain the pull-requests read grant inline zizmor 1.30.1's pedantic undocumented-permissions audit flags the uncommented `pull-requests: read` grant in both caller templates, which failed the ci-runner v0.1.35 release gate. A same-line comment names why check-managed-files needs it. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Q6B1MWhz73WFRYyyrKjtjY --- components/managed-files-guard/managed-files-guard-fleet.yml | 2 +- components/managed-files-guard/managed-files-guard.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/components/managed-files-guard/managed-files-guard-fleet.yml b/components/managed-files-guard/managed-files-guard-fleet.yml index 180e4cf1..e7c1bef1 100644 --- a/components/managed-files-guard/managed-files-guard-fleet.yml +++ b/components/managed-files-guard/managed-files-guard-fleet.yml @@ -98,7 +98,7 @@ on: permissions: contents: read - pull-requests: read + pull-requests: read # check-managed-files lists the PR commits to skip all-Dependabot PRs # Canonical block from the standards `concurrency-policy` component: a newer # push to the same pull request cancels the in-flight guard run; the diff --git a/components/managed-files-guard/managed-files-guard.yml b/components/managed-files-guard/managed-files-guard.yml index 8b823227..5269605b 100644 --- a/components/managed-files-guard/managed-files-guard.yml +++ b/components/managed-files-guard/managed-files-guard.yml @@ -82,7 +82,7 @@ on: permissions: contents: read - pull-requests: read + pull-requests: read # check-managed-files lists the PR commits to skip all-Dependabot PRs # Canonical block from the standards `concurrency-policy` component: a newer # push to the same pull request cancels the in-flight guard run; the